Researchers find Meta Muse share links in passive DNS

Claroc researchers say a query of a commercial passive-DNS service surfaced more than 6,800 Meta Muse conversation-share hostnames, making the public-by-link pages discoverable without anyone having to guess the long random identifiers in their addresses.

Users intentionally published the pages when they asked Muse to share a conversation, Claroc said. Anyone with a link could open one, usually without signing in. The finding concerns discovery of public-by-link pages, not unauthorized access to a user’s Muse account.

According to Claroc, Muse formed each share hostname from a conversation title and a long random identifier under Meta’s content-delivery domain. When someone resolved one of those hostnames, passive DNS could retain the complete name alongside the record type, value and time. Someone with access to that data could retrieve the identifier instead of trying to predict it. Passive DNS records hostname-resolution observations; it does not identify the person who made a lookup.

Claroc said the query returned more than 6,800 hostnames after it filtered noise caused by wildcard-DNS scanning. Its researchers opened only a few hundred. Almost every still-live share in that sample opened without an account or sign-in, while the researchers left one password-protected page alone.

A minority of the sampled pages contained sensitive personal or business information, Claroc said. Examples included preparation for a confidential recruiting call, an internal revenue review, a loan application, a bank-fraud alert containing partial account information, real-estate performance figures and a staff vacation calendar. This article withholds the affected names, hostnames, links and figures.

The 6,800-plus figure is not a count of every Muse share or a measure of the product’s total exposure. Claroc limited its work to one commercial passive-DNS source, one hostname pattern, one product and a short collection window. It could not establish how long individual shares remained reachable or whether anyone else had found them first. Claroc said it had no evidence that anyone misused the shares, but that does not establish that no third party accessed or used them.

Claroc said it checked content on October 7 and 8 and did not reopen the shares afterward, except for one page reopened on October 18 to capture a redacted screenshot. It later observed 27 new hostnames on the final day of monitoring, but described that only as continued discovery, not proof that those pages were still accessible.

Claroc said it reported the issue to Meta’s bug bounty program on October 8 with reproduction steps and example shares. Meta launched Muse on September 8 and said it designed the service to handle sensitive data with privacy and security protections.